don't show projects that a user doesn't have permission to see
restrict reading tickets to correct project scope
restrict creating tickets to only users who have permissions to do it
restrict ticket updating to only thise who have permission
restrict destroy action to only people with permission
restrict actions in ticketsController based on permissions and hide links